yummy-crimson-lzbxdvwjl1-upnu4h479u[.]edgeone[.]dev

This domain, yummy-crimson-lzbxdvwjl1-upnu4h479u.edgeone.dev, is identified as a phishing site specifically targeting Roblox users with fraudulent Robux top-up offers. The domain is currently offline, but prior activity indicates it was designed to harvest login credentials and payment information under the guise of a legitimate Roblox transaction page. The page title, 'Roblox - Top Up Robux,' confirms the impersonation of the official Roblox platform to deceive users into entering sensitive data. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was registered on June 09, 2025, through MarkMonitor, Inc., and resolves to the IP address 43.174.246.29, located in Singapore under AS139341 (ACE). Security vendors on VirusTotal flagged the domain as malicious, with 18 out of 95 vendors detecting it as a phishing threat. The domain appears on two security blocklists, PhishDestroy and PhishingDB, further corroborating its classification as a phishing site. The SSL certificate, issued by DigiCert, Inc. (DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1), does not mitigate the risk, as phishing domains frequently use valid certificates to appear legitimate. As of the latest assessment, the domain has been taken offline, reducing immediate risk to users. However, the infrastructure and tactics observed suggest potential for reemergence under a similar or altered domain. Organizations and users are advised to block the domain and its associated IP address (43.174.246.29) at the network level. Users who may have interacted with the domain should immediately reset their Roblox account credentials and monitor for unauthorized transactions. Security teams should review logs for connections to the domain or IP and investigate any related activity for signs of compromise.